session-orchestrator 5.8.0 → 5.9.0

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "A repeatable Plan, Go, Close workflow for AI coding sessions: /session reads your repo and agrees the scope, /go runs the work in waves with a quality gate between each, /close verifies and commits. Runs on Claude Code, Codex CLI, Cursor and Pi.",
-    "version": "5.8.0"
+    "version": "5.9.0"
   },
   "plugins": [
     {

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "session-orchestrator",
-  "version": "5.8.0",
+  "version": "5.9.0",
   "description": "A repeatable Plan, Go, Close workflow for AI coding sessions: /session reads your repo and agrees the scope, /go runs the work in waves with a quality gate between each, /close verifies and commits. Runs on Claude Code, Codex CLI, Cursor and Pi.",
   "author": {
     "name": "Bernhard Goetzendorfer",

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "session-orchestrator",
-  "version": "5.8.0+codex.20261005120103",
+  "version": "5.9.0+codex.20261006063654",
   "description": "A repeatable Plan, Go, Close workflow for AI coding sessions: /session reads your repo and agrees the scope, /go runs the work in waves with a quality gate between each, /close verifies and commits. Runs on Claude Code, Codex CLI, Cursor and Pi.",
   "keywords": [
     "session",

package/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "session-orchestrator",
-  "version": "5.8.0",
+  "version": "5.9.0",
   "description": "A repeatable Plan, Go, Close workflow for AI coding sessions: /session reads your repo and agrees the scope, /go runs the work in waves with a quality gate between each, /close verifies and commits. Runs on Claude Code, Codex CLI, Cursor and Pi.",
   "author": {
     "name": "Bernhard Goetzendorfer"

package/CHANGELOG.md

@@ -7,6 +7,25 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [5.9.0] - 2026-10-06
+
+### Added
+
+- **Lead page on the website**: `site/lead/` introduces the sibling project lead-session-orchestrator in the site design, linked from the main, German and guide pages, the sitemap and llms.txt; the README and the fleet contract point to it.
+
+### Changed
+
+- **CI status banner, GitHub path**: unfinished check runs get their own reasons `check-runs-in-progress`, `check-runs-queued` and `check-runs-cancelled` (several kinds at once: `check-runs-mixed`) instead of `check-runs-not-complete`, and `details.checkRunCounts` carries additive counts per kind, shown by the session-start banner for `unknown`/`red`; the gh hint applies to every GitHub reason. Status vocabulary and severity are unchanged (#856).
+- **CI status banner** names GitHub check runs in the valid states `skipped`, `neutral` and `waiting`/`pending`/`requested` with their own reasons (`check-runs-skipped`, `-neutral`, `-waiting`) and banner labels instead of `check-runs-not-complete`; the status vocabulary `green | red | unknown` is unchanged (#1526).
+- **Session-record validator** rejects millisecond-precise but calendar-invalid timestamps (round-trip check); this deliberately also rejects the ISO end-of-day form `T24:00:00Z`, which no producer writes (#1526).
+- **Prose readers of the gate result** (`skills/wave-executor/references/wave-loop-review.md`, `skills/session-end/metrics-collection.md`) take `suite_passed`/`suite_failed` from the `orchestrator.quality_gate.*` event selected by `semantic_session_id` + `wave_number` (last record of the wave) with one identical `jq` selector that skips unreadable ledger lines instead of silently returning nothing; the counts fallback applies only to pre-#954 sessions, a gate run outside the wrapper (including an event without `semantic_session_id`) and a missing wave, and reads this wave's own gate output in wave-loop step 7 (which runs before the header is written) and the STATE.md header at session end, the same sources as `suite_platform`. `docs/events-schema.md` and the emitter docblocks describe that contract (#966 steps 2–3).
+- **Quality-gate events** carry an optional `wave_number` (positive safe integer from the session's own wave scope, omitted when unknown) on `orchestrator.quality_gate.*` from both the CLI and the library path; the auto-fix-loop record therefore now matches the per-wave selector (#966 step 1).
+
+### Fixed
+
+- **Remote-offload readiness** (#1524): Claude dispatch authorizes on the new `headless-ready=yes` marker; the legacy `ready=yes` is accepted only when no new readiness marker (`gate-ready`, `headless-ready`) is on the line, and `gate-ready` alone no longer authorizes Claude dispatch. Conflicting or unknown headless values fail closed.
+- **`session-record-repair`** (#1525) also normalizes microsecond-precise timestamps with a `+00:00` offset to milliseconds, after a calendar round-trip check; the original value is preserved, and an invalid `ended_at` produces no substitute.
+
 ## [5.8.0] - 2026-10-05
 
 ### Added

package/README.md

@@ -1,7 +1,7 @@
 # Session Orchestrator
 
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
-[![Version](https://img.shields.io/badge/version-5.8.0-blue.svg)](CHANGELOG.md)
+[![Version](https://img.shields.io/badge/version-5.9.0-blue.svg)](CHANGELOG.md)
 [![npm](https://img.shields.io/npm/v/session-orchestrator.svg)](https://www.npmjs.com/package/session-orchestrator)
 
 **Give your agents a working rhythm.**
@@ -139,15 +139,14 @@ How this compares to other orchestrators, with measured results kept separate fr
 
 All four platforms share the same skills, commands and scripts; only the hooks differ, because each harness fires different events. Codex leaves its `PreToolUse` handlers empty because these guards do not yet match its tool names and edit payloads ([why](docs/codex-setup.md#why-our-pretooluse-guards-stay-unwired--the-reason-corrected)). Cursor and Pi have known event-coverage limits — see [`docs/cursor-setup.md`](docs/cursor-setup.md) and [`docs/pi-setup.md`](docs/pi-setup.md).
 
-## Recent highlights (v5.8.0)
+## Recent highlights (v5.9.0)
 
-Highlights of the v5.8.0 line:
+Highlights of the v5.9.0 line:
 
-- **Your secrets stay out of the plugin cache.** Claude and Codex installs now come from the packed package (`npm pack`), so `.env.local` and session state no longer land in `~/.claude` or `~/.codex` plugin caches (#1515, #1518).
-- **`mirror: none` means none.** `/close` no longer pushes to a GitHub remote when the repo opted out, and a fresh shell without `PLUGIN_ROOT` no longer breaks the mirror push (#1034).
-- **Honest gate scores.** Eval rubric v3 counts a gate run that was killed but exited 0 as failed; older records keep their own rubric version and are never re-scored silently (#1487).
-- **Rules live through their expiry day.** A rule's `expires-at` date is inclusive in the loader, the budget probe, the drift check and the expiry sweep alike (#1521).
-- **vault-sync needs no second install.** The validator resolves `zod`/`yaml` from the plugin's own dependencies and, if they are missing, says exactly which command fixes it (#1070).
+- **Gate counts per wave.** Quality-gate events now carry an optional `wave_number`, and the wave loop and `/close` read `suite_passed`/`suite_failed` from the gate event of exactly that wave, skipping unreadable ledger lines instead of silently returning nothing (#966).
+- **The CI banner says why a check is not green.** GitHub check runs that are in progress, queued, cancelled, `skipped`, `neutral` or waiting get their own reason, with counts per kind, instead of `check-runs-not-complete` (#856, #1526).
+- **Impossible timestamps are rejected.** The session-record validator refuses millisecond-precise timestamps that are not a real calendar date (#1526).
+- **A page for the lead session.** `site/lead/` introduces the sibling project lead-session-orchestrator, linked from the main, German and guide pages.
 
 Full changes and verification: [CHANGELOG.md](CHANGELOG.md).
 
@@ -159,6 +158,10 @@ Full changes and verification: [CHANGELOG.md](CHANGELOG.md).
 - [Telemetry](docs/telemetry.md) — what stays on your machine, what the optional anonymous telemetry would send, and every switch that turns it off
 - [Contributing](https://github.com/Kanevry/session-orchestrator/blob/main/CONTRIBUTING.md) · [Plugin architecture](docs/plugin-architecture-v3.md) · [docs/ router](docs/README.md)
 
+## Running many sessions at once
+
+session-orchestrator makes one session reliable. When several sessions run in parallel across repositories, a lead session can coordinate them: who runs next, what each may do, one queue for your decisions, one stop for everything. That is the sibling project [lead-session-orchestrator](https://session-orchestrator.com/lead) ([GitHub](https://github.com/Kanevry/lead-session-orchestrator), npm `lead-session-orchestrator`). Each works alone; together they use the shared fleet contract in `skills/_shared/fleet-protocol.md`.
+
 ## Scope and support
 
 Provided **as-is**: a community project, best-effort maintenance, no SLA. Questions and ideas go to [Discussions](https://github.com/Kanevry/session-orchestrator/discussions), bugs to [Issues](https://github.com/Kanevry/session-orchestrator/issues).

package/docs/events-schema.md

@@ -66,6 +66,46 @@ instead of `jq >> events.jsonl`. For callers that manage their own stream path,
 `emitEvent(type, payload, { filePath })` accepts an additive optional path override
 (default = the resolved `eventsFilePath()`); existing two-argument callers are unchanged.
 
+## Quality-gate wave metrics consumers
+
+The readers are two skill readers,
+[`wave-loop-review.md` step 7](../skills/wave-executor/references/wave-loop-review.md)
+and [`metrics-collection.md` § 1.7](../skills/session-end/metrics-collection.md),
+and the convergence monitor (`scripts/lib/convergence-monitor.mjs`), which folds
+`counts` only from gate records that also carry `wave_number`. The two skill readers read `orchestrator.quality_gate.{passed,failed}` as flat records, filtering
+by the existing own `semantic_session_id` and `wave_number`, then taking the
+last matching record with `counts`. `counts.passed` supplies `suite_passed`;
+`counts.failed` supplies `suite_failed`. Their identical jq selectors exclude
+other sessions, other waves, and unrelated events without a time-window join.
+They read the ledger raw (`jq -R` with `fromjson? | objects`), so an unreadable
+line such as a torn tail is skipped instead of aborting `jq` and emptying the result.
+An event without `semantic_session_id` (emitters set it only from the session lock)
+never matches and is treated like a gate outside the event wrapper.
+
+Both emitters supply the same optional counts and wave keys: the CLI emits once
+per CLI run; the library emits once per `runQualityGateWithRetry` call, never
+per retry (`attempts` describes retries). Missing `counts` or `wave_number` stays
+absent, never zero-filled. An empty selector or an event without counts, such
+as fail-fast before the test suite, does not alone permit header fallback.
+Telemetry remains best-effort; emission does not change gate exits or verdicts.
+The event-name and reporting-variant contracts in the catalogue below still apply.
+
+Count fallback is limited to three cases: pre-#954 sessions, a gate outside the
+event wrapper, or missing wave attribution. Its source differs by reader: step 7
+runs before § 3a writes this wave's header and falls back to the output of this
+wave's own gate run; session end falls back to the STATE.md Wave History header
+`— suite <passed>/<failed> on <platform>`.
+An auto-fix call with a known wave uses the event selector. When neither an event
+measurement nor an applicable header fallback supplies counts, omit the two
+count fields: absence means unmeasured; a present zero means measured zero.
+
+`suite_platform` comes separately from the platform of this wave's gate run
+(step 7) or the header that run wrote (session end); there is **no platform field
+in the event payload**. Omit it without such a measurement, and never infer it
+from `variant`. Event-derived
+counts may still be mirrored into the existing header as compatibility output,
+not a second measurement source. Header and sessions.jsonl contracts are unchanged.
+
 ## Naming convention
 
 Orchestrator-owned events use a dotted namespace:
@@ -105,7 +145,7 @@ namespace we own. The validator + regex live in `scripts/lib/events-schema.mjs`
 | `orchestrator.memory.propose_invoked` | `hooks/pre-bash-memory-propose-audit.mjs` | PreToolUse(Bash), once per `node … memory-propose.mjs …` invocation the G3 regex matches — observe-only, the hook never denies. **Payload:** `session_id` (or `null`), `wave`, `cwd` (the working directory RELATIVE to the resolved project dir — `.` when equal, `scripts/lib` from a subdirectory; a directory OUTSIDE the project is written as `sha256:<12 hex>` of its resolved path, and so is EVERY cwd when the project dir is the filesystem root, the home dir or an ancestor of it (`/Users`), where the relative form would read `Users/<name>/…`; that 12-hex sha256 prefix is PSEUDONYMISATION, not anonymisation — a guessable path (a home dir, a usual checkout location) is recovered offline by hashing candidates; **never an absolute path** — until 2026-09-25 (#1439) it was `process.cwd()` verbatim, i.e. the operator's home path in an `events.jsonl` line; zero production readers), `exit_code` (always `null` — a PreToolUse hook runs BEFORE the command), plus the #1415 argv summary: `command_hash` (**sha256 of the RAW command, truncated to 16 hex — same recipe as `enforce-commands` after `8f15f77b`; never the command text**), `flags_present` (string[], the subset of `memory-propose.mjs`'s OWN flag NAMES — `type`, `subject`, `insight`, `evidence`, `confidence`, `dry-run`, `file-paths`, `help` — present in the command, in that fixed order; built by intersecting a CLOSED list, never by scraping `--\S+`, so a flag-shaped VALUE can never be reported as a flag) and `argv_length` (number, the raw command's character count). Until 2026-09-21 this row carried `argv_truncated`: 512 characters of command TEXT, redacted only per-VALUE for five flags, whose own caveat named its gaps (`--insight=$VAR`, `--insight=$(cat secret)`, a secret written anywhere else on the line). It went into an `events.jsonl` line (gitignored here via `.gitignore:57`; consumer repos may track it) and, with the Clank webhook configured, onto the network. **Measured 2026-09-21** (`rg argv_truncated` over `scripts/ hooks/ skills/ docs/`): **zero production readers** — the field's only consumers were this hook's own tests. Pinned in `tests/hooks/pre-bash-memory-propose-audit.test.mjs` in BOTH directions (summary fields present AND `argv_truncated`/`command` undefined), plus a negative test that string-searches the serialized record for every sentinel value — so nobody puts the raw field back beside the hash |
 | `orchestrator.wave.completed` | `hooks/post-tool-batch-wave-signal.mjs` · `hooks/on-session-end.mjs` (`emitFinalWaveCompleted`) | PostToolBatch — fires live via `.claude/wave-scope.json` `.wave` increase (mechanical fallback, #612), closing wave N at the N→N+1 transition; an explicit injected `wave_signal: 'wave-complete'` still takes precedence. **The former `started` sibling was REMOVED 2026-09-19** (operator decision, #1202 §11): it carried no measurement, its only reader was `scripts/lib/convergence-monitor.mjs`, and there it cost the one signal it could not feed — the batch hook wrote it in the same millisecond as completed{N}, so both shared a tail tick and it masked the (N-1, N) `shrinking_diff` pair. An injected `wave_signal: 'wave-start'` is still accepted and emits nothing; historical records stay in the ledgers and nothing reads them. **Re-emission ceiling (open):** a session that does not own `.orchestrator/current-session.json` never advances the marks below, so each of its batches re-emits completed{lastWave} until its own SessionStart takes the file over — measured 2026-09-19 as up to 579 emissions for one (session_id, wave_number) group. **Second `.completed` emitter (#1193):** the batch hook closes wave N-1 only at an N-1→N transition, so the LAST wave of every session never received a completion — measured fleet-wide 2026-09-02 as **296 gaps over 296 wave runs** (1018 started vs 722 completed), exactly one missing final completion per run. SessionEnd now emits it. **Payload of that record:** `wave_number` (the `current-session.json` `last_wave`), `reason: 'session-end'`, `emitted_by: 'on-session-end'`, plus `session_id` / `semantic_session_id` — **omitted when unattested**, never fabricated. **Idempotent** via the `last_wave_completed` high-water mark in `.orchestrator/current-session.json`, written by BOTH emitters and preserved across `/clear`+compact by `on-session-start.mjs`; `last_wave` absent or `0` emits nothing (an Express-Path or coordinator-direct session never batched, and zero waves is the correct reading, not a gap). **Two gates on the SessionEnd emitter, both load-bearing:** (a) OWNERSHIP — `current-session.json` is a single repo-global file describing whichever session most recently ran SessionStart, routinely a different still-live session in a shared working copy, so the emit reuses `resolveSession()`'s `isRecordedSession` predicate; when false it emits nothing AND writes nothing, since writing the marker into a peer's file would silence the peer's own SessionEnd and preserve this very gap on the wrong session. (b) REASON — `reason === 'clear'` **and `reason === 'resume'`** are SKIPPED: the SessionEnd matcher is empty, so `/clear` fires the hook mid-wave while the LOGICAL session continues, and `on-session-start.mjs` preserves `last_wave` / `last_wave_completed` across a resume of the SAME logical session exactly as it does across a clear — so both end the HARNESS session, not the logical one. Closing the live wave on either is premature, and the preserved marker would then suppress the real completion later. Resume is the MORE common of the two (fleet n = 1498 `session.ended`, 2026-09-02: 12 `resume` vs 9 `clear`). Deliberately SessionEnd-only (`on-stop.mjs` is not mirrored) so the closed-vs-abandoned split stays measurable. **Diff-size keys on the BATCH-HOOK emitter only (#980):** `files_changed` (integer) + `files_changed_source: 'worktree-vs-wave-start-sha'` (the only value emitted today; present iff `files_changed` is). Measurement: the DEDUPED union of `git diff --name-only <wave_start_sha>` and `git ls-files --others --exclude-standard`, run in the project dir at the N→N+1 transition, where `wave_start_sha` is the `git rev-parse HEAD` the batch hook persisted into `.orchestrator/current-session.json` when wave N was OPENED (same ownership gate as the wave keys; written as `null` when git is unreadable, so a previous wave's sha can never inflate the next count). Worktree-vs-sha rather than `<sha>..HEAD` because the coordinator commits at session close, not per wave — a commit-only diff reads 0 for every wave of a normal session. **Both keys are OPTIONAL and absent-is-not-zero:** any git failure, a 1.5 s timeout, or a missing `wave_start_sha` omits them, and `scripts/lib/convergence-monitor.mjs` reads an absent key as `null`, so the `shrinking_diff` signal simply does not fire (it never reads a fabricated 0). The `on-session-end.mjs` final-wave `.completed` carries NEITHER key by design — no wave-open transition runs there, so it has no start sha to measure against |
 | `orchestrator.wave.final_refused` | `hooks/on-session-end.mjs` (`emitFinalWaveCompleted` → `emitFinalRefused`, via `emitEvent(..., {repoRoot})` + `sessionAttribution(repoRoot)`, wrapped in its OWN try/catch — independent of the caller's outer catch — so a telemetry failure on one refusal can never surface as a teardown failure) | the SIBLING event to `orchestrator.wave.completed` above (#1201 Part B / Discovery D8) — fires exactly once per SessionEnd in which the final `.completed` was NOT emitted, one row per refusal. Deliberately a SEPARATE event name rather than `.completed` carrying `emitted:false`: existing consumers of `.completed` treat every row as a finished wave, and overloading it would silently corrupt that count. **Payload:** `reason` (always present, closed enum — verified against `emitFinalWaveCompleted`'s own call sites) `not-recorded` \| `clear` \| `resume` \| `unreadable` \| `session-id-mismatch` \| `no-wave` \| `already-completed` \| `exception`, `emitted_by: 'on-session-end'` (always), plus `session_id` / `semantic_session_id` — omitted when `null`, never fabricated. **Optional, absent-is-not-zero:** `wave_number` — present ONLY on the `already-completed` reason, the sole call site that passes a resolved `last_wave` through to `emitFinalRefused`; every other reason, INCLUDING `no-wave`, omits it (that path never resolved a wave number at all — the function's own JSDoc pins this: "only when `last_wave` was resolved to a positive number before the refusal (currently only `already-completed`)"). Six of the eight reasons were previously SILENT refusal paths with no trace anywhere (`.claude/rules/host-resources.md` § HR-105: "a refusal that writes nothing is unfalsifiable") |
-| `orchestrator.quality_gate.passed` / `.failed` | `scripts/run-quality-gate.mjs` (the gate CLI — live between waves) · `scripts/lib/quality-gate.mjs` (`emitGateEvent` inside `runQualityGateWithRetry`, reached ONLY under `verification-auto-fix.enabled: true` — default `false`, and `false` in this repo) | CLI: once per gate-CLI run. Library: once per `runQualityGateWithRetry` **call**, never per retry attempt (`attempts` carries that detail). The two paths never nest, so one run passes through exactly one emitter. **Name (CLI, #1459, 2026-10-01):** `.failed` when `exit_code` ≠ 0 OR the joined kill fields say `timed_out: true`, in every variant. The reporting variants (`baseline` \| `incremental` \| `per-file`) exit 0 even after a failing check, so for them `.passed` means "not killed", not "checks green" — the check verdict lives in the gate output, not in the event name. **Payload (both):** `variant`, `exit_code`, plus `session_id` / `semantic_session_id` when `sessionAttribution()` finds a session lock (both omitted when it does not). CLI `variant` is the `--variant` value (`baseline`\|`incremental`\|`full-gate`\|`per-file`); the library pins `variant: 'auto-fix-loop'`. **CLI only:** `wave_number`, and `failed_files` (string[] — the failing test FILES `gate-full.mjs` names when the runner printed a file-level summary; **omitted, never `[]`**, when nothing named a file — an empty array would read as "no file failed"). **Library only:** `attempts` (1…`maxRetries+1`) and `gate` (`lint`\|`typecheck`\|`test` — the fail-fast gate of the last attempt; omitted on the passing path). **Kill-ladder fields (#1439, #1457, 2026-09-25):** `timed_out` (boolean — the run hit its wall-clock ceiling and was killed), `survivors` (integer — pids still alive after the SIGKILL step, `0` when none; the pids themselves stay in the gate output / diagnostics bundle) and `kill_signals` (string[] — the signals actually sent, in order, e.g. `["SIGTERM","SIGKILL"]`; `[]` when none). Both emitters start from the ONE shared `gateKillFields()` (`scripts/lib/quality-gate.mjs`); from the library emitter `false` / `0` / `[]` are therefore measurements ("not killed"), not absence — the CLI emitter additionally passes them through `joinGateKillFields()` and may omit the keys (see below, #1457). The library always carries all three. The CLI JOINS two ladders with `joinGateKillFields()` (`scripts/lib/gates/gate-helpers.mjs`): the OUTER one over the gate sub-script as a whole (that run exits 124), and the INNER per-command ones the gate's JSON envelope publishes — every variant (`gate-full.mjs` on `typecheck`/`test`/`lint`, `gate-{baseline,incremental,per-file}.mjs` on `typecheck`/`test` since #1457 pkt 12) puts `timed_out` / `kill_signals` / `survivors` (pids) on each command object it actually spawned, so a single command killed by the per-command ceiling (exit 2) now reads `timed_out: true`. Join: `timed_out` = outer OR any inner, `kill_signals` = outer followed by each command's in execution order, `survivors` = outer count plus every inner pid count. **The CLI omits all three keys** when the inner side was not measured — an envelope without the per-command ladder (all four variants publish it since #1457 pkt 12, so today this means an older gate script) or an unparseable envelope — and the outer ladder did not fire; a fired outer ladder is reported alone. The library reports the failing gate command of the last attempt, and `false` / `0` / `[]` on the passing path (every gate exited 0, so none was killed). **Optional on both:** `counts: {passed, failed, total}`. **Absent is not zero — for both optional fields.** `counts` is admitted by the ONE shared policy `admitSuiteCounts()` (`scripts/lib/gates/gate-helpers.mjs`, #967 item 2), which returns `null` — never a zero triple — for an unmeasured or inconsistent input (test gate skipped/stubbed, fail-fast on lint or typecheck before the test step, no parseable `<N> passed` marker, or `passed + failed !== total`); both callers spread `...(counts ? { counts } : {})`, so the KEY is missing in those runs. A present `counts.failed: 0` therefore means "measured, zero failures", while an absent `counts` means "not measured" — reading a missing field as `0` mis-analyses the ledger in both directions. Same contract for `wave_number` (CLI, #966 step 1): resolved from the `.{pi,cursor,codex,claude}/wave-scope.json` sidecar, **omitted** — never `0` — when there is no sidecar or its `wave` is non-numeric/non-positive; a human running `npm run quality-gate` from a `git push` has no wave at all, so an invented wave 0 would have to be special-cased by every consumer. Note `total` is `passed + failed` and EXCLUDES skipped/todo (see `extractTestCounts`) |
+| `orchestrator.quality_gate.passed` / `.failed` | `scripts/run-quality-gate.mjs` (the gate CLI — live between waves) · `scripts/lib/quality-gate.mjs` (`emitGateEvent` inside `runQualityGateWithRetry`, reached ONLY under `verification-auto-fix.enabled: true` — default `false`, and `false` in this repo) | CLI: once per gate-CLI run. Library: once per `runQualityGateWithRetry` **call**, never per retry attempt (`attempts` carries that detail). The two paths never nest, so one run passes through exactly one emitter. **Name (CLI, #1459, 2026-10-01):** `.failed` when `exit_code` ≠ 0 OR the joined kill fields say `timed_out: true`, in every variant. The reporting variants (`baseline` \| `incremental` \| `per-file`) exit 0 even after a failing check, so for them `.passed` means "not killed", not "checks green" — the check verdict lives in the gate output, not in the event name. **Payload (both):** `variant`, `exit_code`, plus `session_id` / `semantic_session_id` when `sessionAttribution()` finds a session lock (both omitted when it does not). CLI `variant` is the `--variant` value (`baseline`\|`incremental`\|`full-gate`\|`per-file`); the library pins `variant: 'auto-fix-loop'`. **Both emitters:** optional `wave_number` (positive safe integer from the running own-session manifest at the event root). **CLI only:** `failed_files` (string[] — the failing test FILES `gate-full.mjs` names when the runner printed a file-level summary; **omitted, never `[]`**, when nothing named a file — an empty array would read as "no file failed"). **Library only:** `attempts` (1…`maxRetries+1`) and `gate` (`lint`\|`typecheck`\|`test` — the fail-fast gate of the last attempt; omitted on the passing path). **Kill-ladder fields (#1439, #1457, 2026-09-25):** `timed_out` (boolean — the run hit its wall-clock ceiling and was killed), `survivors` (integer — pids still alive after the SIGKILL step, `0` when none; the pids themselves stay in the gate output / diagnostics bundle) and `kill_signals` (string[] — the signals actually sent, in order, e.g. `["SIGTERM","SIGKILL"]`; `[]` when none). Both emitters start from the ONE shared `gateKillFields()` (`scripts/lib/quality-gate.mjs`); from the library emitter `false` / `0` / `[]` are therefore measurements ("not killed"), not absence — the CLI emitter additionally passes them through `joinGateKillFields()` and may omit the keys (see below, #1457). The library always carries all three. The CLI JOINS two ladders with `joinGateKillFields()` (`scripts/lib/gates/gate-helpers.mjs`): the OUTER one over the gate sub-script as a whole (that run exits 124), and the INNER per-command ones the gate's JSON envelope publishes — every variant (`gate-full.mjs` on `typecheck`/`test`/`lint`, `gate-{baseline,incremental,per-file}.mjs` on `typecheck`/`test` since #1457 pkt 12) puts `timed_out` / `kill_signals` / `survivors` (pids) on each command object it actually spawned, so a single command killed by the per-command ceiling (exit 2) now reads `timed_out: true`. Join: `timed_out` = outer OR any inner, `kill_signals` = outer followed by each command's in execution order, `survivors` = outer count plus every inner pid count. **The CLI omits all three keys** when the inner side was not measured — an envelope without the per-command ladder (all four variants publish it since #1457 pkt 12, so today this means an older gate script) or an unparseable envelope — and the outer ladder did not fire; a fired outer ladder is reported alone. The library reports the failing gate command of the last attempt, and `false` / `0` / `[]` on the passing path (every gate exited 0, so none was killed). **Optional on both:** `counts: {passed, failed, total}`. **Absent is not zero — for both optional fields.** `counts` is admitted by the ONE shared policy `admitSuiteCounts()` (`scripts/lib/gates/gate-helpers.mjs`, #967 item 2), which returns `null` — never a zero triple — for an unmeasured or inconsistent input (test gate skipped/stubbed, fail-fast on lint or typecheck before the test step, no parseable `<N> passed` marker, or `passed + failed !== total`); both callers spread `...(counts ? { counts } : {})`, so the KEY is missing in those runs. A present `counts.failed: 0` therefore means "measured, zero failures", while an absent `counts` means "not measured" — reading a missing field as `0` mis-analyses the ledger in both directions. Same contract for `wave_number` (both emitters, #966 step 1): resolved from the `.{pi,cursor,codex,claude}/wave-scope.json` sidecar, **omitted** — never `0` — when there is no sidecar or its `wave` is not a positive safe integer; a human running `npm run quality-gate` from a `git push` has no wave at all, so an invented wave 0 would have to be special-cased by every consumer. Note `total` is `passed + failed` and EXCLUDES skipped/todo (see `extractTestCounts`) |
 | `orchestrator.scope.coordinator_carveout_allowed` | `hooks/enforce-scope.mjs` (coordinator carveout, #245 / #1361) | exactly once per ALLOWED write BY THE COORDINATOR into one of the harness-owned in-repo files the carveout covers — `.claude/STATE.md` and its `.codex/` / `.cursor/` / `.pi/` siblings, plus the exact relative path of the live `wave-scope.json` the hook itself just read. Since #1361 a payload carrying `agent_id` is a dispatched subagent: it gets no carveout and falls through to Gate 7, where a manifest that does not grant the path is a DENY (a subagent permitted to write `wave-scope.json` could rewrite its own file scope and disarm every later gate of the wave; STATE.md is coordinator-owned per `skills/_shared/state-ownership.md`). **Payload:** `hook`, `manifest` (the manifest path), `wave`, `file_path` (the project-RELATIVE, forward-slash-normalized path — the carveout set is in-repo by construction, so no host-local absolute path enters the ledger) and `discriminator` (`'coordinator' \| 'malformed' \| 'absent'` — same enum and same meanings as `orchestrator.scope.memory_dir_allowed`: `'coordinator'` = `agent_type` present without `agent_id`; `'malformed'` = an `agent_id` key present but unusable (number, object, array, blank string), a fail-open that must stay rare; `'absent'` = no `agent_id` key at all, the harness's documented main-thread shape. `'subagent'` never appears here BECAUSE a subagent gets no carveout and so emits no allow) — exactly the five keys the `emitEvent` call passes, with `{ repoRoot: projectRoot }` as options. **Fail-safe:** awaited BEFORE `emitAllow()` (which calls `process.exit()` and would discard a pending append) and wrapped in its own `try {} catch {}`, so a telemetry failure can never flip the decision. Before #1361 this branch was a bare `emitAllow()` with no log and no event, so whether it ever fired was unfalsifiable after the fact (HR-105) | <!-- path-check: example -->
 | `orchestrator.scope.foreign_session_ignored` | `hooks/enforce-scope.mjs` (Gate 3b, #1123) · `hooks/enforce-commands.mjs` · `hooks/post-bash-write-verify.mjs` (both Gate 3b, #1153 P1) | exactly once per gated tool call while a FOREIGN-session `wave-scope.json` is live: the manifest's `session_id`/`semantic_session_id` provably name another session (legacy `session`/`semantic_session` still read, #1153 P2), so the hook stands down instead of enforcing. Since #1504 point 6 only when EVERY existing candidate (`.pi` > `.cursor` > `.codex` > `.claude`) is foreign — a peer's higher-precedence manifest no longer hides this session's own one (`findOwnScopeFile()`, `scripts/lib/scope-gate.mjs`); `manifest` then names the first foreign candidate. **Payload:** `hook`, `manifest` (path), `manifest_session` (string[]), `own_session` (string[]), `wave`; additionally `file_path` from `enforce-scope` (PreToolUse Edit/Write) and `command_hash` from `enforce-commands` (PreToolUse Bash) — **sha256 auf 16 Hex gekuerzt, NIE das rohe Kommando.** Bis 2026-09-19 stand hier `command` im Klartext, und zwar als dokumentierter Vertrag, nicht als Versehen. Gemessen in EventDrop.at (#1140): **3.816 Zeilen** der GETRACKTEN `.orchestrator/metrics/events.jsonl` trugen ein rohes Kommando, darin **24 distinkte echte Produktions-Share-Codes** aus **17 fremden Kundenkonten** plus ein protokollierter `select access_pin_hash` — bei 23 dieser Events ist der Share-Code die VOLLSTAENDIGE Capability (`/event/<code>` oeffnet das Album ohne Anmeldung), und das Journal geht bei jedem Klon mit. Der Geschwisterhook `pre-bash-destructive-guard.mjs` fuehrte von Anfang an `command_hash` und sagt den Grund im eigenen Kopf; diese Zeile war die Ausnahme. Der Hash haelt das Ereignis zaehlbar und gruppierbar — genau die Eigenschaft, fuer die es laut `docs/scope-collision-guard.md` existiert; das Rohfeld hatte keinen Leser. Gepinnt in `tests/hooks/enforce-commands.test.mjs` in BEIDE Richtungen (Hash vorhanden UND `command` undefined), damit niemand das Rohfeld neben den Hash zuruecklegt. **Der zweite rohe Schreiber derselben Klasse — `hooks/pre-bash-staging-fence.mjs` (512 Zeichen rohes Kommando je Eintrag) — ist seit #1404 (2026-09-20) geschlossen:** der Fence speichert jetzt die Pfad-Operanden plus `command_hash`, nie den Kommandotext. Belegt mit einem Test-Secret im Kommando: `grep -c` auf die Fence-Datei findet es 0-mal, ebenso 0 Vorkommen eines `command`-Feldes. Der einzige Leser (`hooks/wave-scope-commit-guard.mjs`) vergleicht seitdem Pfadlisten statt den Rohtext per Regex zu durchsuchen — was nebenbei `git add -A` abdeckt, das der Regex-Leser nie erkannte. **Die DRITTE und letzte Stelle derselben Klasse — `hooks/pre-bash-memory-propose-audit.mjs` (`argv_truncated`: 512 Zeichen nur flag-redigiertes Kommando in `orchestrator.memory.propose_invoked`, also in die GETRACKTE `events.jsonl` und optional an den Webhook) — ist seit #1415 (2026-09-21) geschlossen, analog `8f15f77b` und #1404:** der Hook schreibt jetzt `command_hash` + `flags_present` + `argv_length`, nie den Kommandotext. Gemessen vor dem Fix: 0 Produktionsleser des Rohfelds. Damit ist die Klasse zu — kein Hook dieses Repos legt mehr rohen Kommandotext in ein Event oder eine Kontrolldatei. `post-bash-write-verify` (PostToolUse Bash) carries neither — it reports on the working tree, not on one tool input. Legacy manifests without a session-binding field never emit this — they stay enforced |
 | `orchestrator.scope.memory_dir_allowed` | `hooks/enforce-scope.mjs` (Gate 5c, #1295) | exactly once per ALLOWED write BY THE COORDINATOR (#1352 — a payload carrying `agent_id` is a dispatched subagent, gets no carve-out and falls through to the normal gates) into THIS repo's harness auto-memory directory `~/.claude/projects/<encodeProjectDir(repoRoot)>/memory/` — the single out-of-repo carveout, evaluated only on the out-of-root branch (Gate 6) and only when a `wave-scope.json` manifest is live, so the in-repo gates are untouched. **Payload:** `hook`, `manifest` (the manifest path), `wave`, `file_path` (the REALPATH-resolved candidate) and, since #1352, `discriminator` (`'coordinator' \| 'malformed' \| 'absent'` — `'coordinator'` = `agent_type` present without `agent_id`; `'malformed'` = an `agent_id` key present but unusable (number, object, array, blank string), a fail-open that must stay rare; `'absent'` = no `agent_id` key at all, the harness's documented main-thread shape. `'subagent'` never appears here BECAUSE a subagent gets no carve-out and so emits no allow) — exactly the five keys the `emitEvent` call passes, with `{ repoRoot: projectRoot }` as options. **Fail-safe:** awaited BEFORE `emitAllow()` (which calls `process.exit()` and would discard a pending append) and wrapped in its own `try {} catch {}`, so a telemetry failure can never flip the decision. This row is the audit trail for the carveout: it is the only place an out-of-repo ALLOW becomes measurable after the fact |

package/hooks/hooks-codex.json

@@ -7,7 +7,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "echo '🎯 Session Orchestrator v5.8.0 — /session [housekeeping|feature|deep] | /plan [new|feature|retro] | /discovery [scope] | /evolve [analyze|review|list]'",
+            "command": "echo '🎯 Session Orchestrator v5.9.0 — /session [housekeeping|feature|deep] | /plan [new|feature|retro] | /discovery [scope] | /evolve [analyze|review|list]'",
             "async": false
           },
           {

package/hooks/hooks.json

@@ -6,7 +6,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "echo '🎯 Session Orchestrator v5.8.0 — /session [housekeeping|feature|deep] | /plan [new|feature|retro] | /discovery [scope] | /evolve [analyze|review|list]'",
+            "command": "echo '🎯 Session Orchestrator v5.9.0 — /session [housekeeping|feature|deep] | /plan [new|feature|retro] | /discovery [scope] | /evolve [analyze|review|list]'",
             "async": false
           },
           {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "session-orchestrator",
-  "version": "5.8.0",
+  "version": "5.9.0",
   "description": "Your coding agents get an agreed plan, a check after each round of changes and a handover to the next session. Plan, Go, Close: /session reads your repo and agrees the scope, /go runs the work in waves with your tests and typecheck after each implementation wave, /close runs the full gate, verifies, commits and files the rest as issues. Scope and destructive-command guards, crash-safe resume, learnings you approve. For Claude Code, Codex CLI, Cursor and Pi.",
   "type": "module",
   "homepage": "https://session-orchestrator.com",

package/scripts/lib/ci-status-banner.mjs

@@ -1089,8 +1089,23 @@ async function checkGithub(repoRoot, deps = {}) {
     };
   }
 
+  // #856: lifecycle and conclusion are separate facts. Failure retains
+  // priority even in an inconsistent row; only completed success grants green.
+  // Counts are additive diagnostics, never a new status or gate authority.
+  const checkRunCounts = { success: 0, failure: 0, inProgress: 0, queued: 0, cancelled: 0, skipped: 0, neutral: 0, waiting: 0, other: 0 };
+  for (const run of checkRuns) {
+    if (run?.conclusion === 'failure' || run?.conclusion === 'action_required') checkRunCounts.failure++;
+    else if (run?.status === 'completed' && run?.conclusion === 'success') checkRunCounts.success++;
+    else if (run?.status === 'completed' && run?.conclusion === 'cancelled') checkRunCounts.cancelled++;
+    else if (run?.status === 'completed' && run?.conclusion === 'skipped') checkRunCounts.skipped++;
+    else if (run?.status === 'completed' && run?.conclusion === 'neutral') checkRunCounts.neutral++;
+    else if (['waiting', 'pending', 'requested'].includes(run?.status) && run?.conclusion === null) checkRunCounts.waiting++;
+    else if (run?.status === 'in_progress' && run?.conclusion === null) checkRunCounts.inProgress++;
+    else if (run?.status === 'queued' && run?.conclusion === null) checkRunCounts.queued++;
+    else checkRunCounts.other++;
+  }
   const failedRun = checkRuns.find(
-    (r) => r.conclusion === 'failure' || r.conclusion === 'action_required',
+    (r) => r?.conclusion === 'failure' || r?.conclusion === 'action_required',
   );
 
   if (failedRun) {
@@ -1101,11 +1116,12 @@ async function checkGithub(repoRoot, deps = {}) {
       details: {
         cliUsed: 'gh',
         reason: 'lastGreen-not-implemented-for-github',
+        checkRunCounts,
       },
     };
   }
 
-  const allSuccess = checkRuns.every((r) => r.conclusion === 'success');
+  const allSuccess = checkRunCounts.success === checkRuns.length;
   if (allSuccess) {
     return {
       status: 'green',
@@ -1116,13 +1132,24 @@ async function checkGithub(repoRoot, deps = {}) {
     };
   }
 
-  // Some runs pending / in-progress / etc.
+  const states = [
+    ['inProgress', 'check-runs-in-progress'],
+    ['queued', 'check-runs-queued'],
+    ['cancelled', 'check-runs-cancelled'],
+    ['skipped', 'check-runs-skipped'],
+    ['neutral', 'check-runs-neutral'],
+    ['waiting', 'check-runs-waiting'],
+    ['other', 'check-runs-unrecognised'],
+  ].filter(([key]) => checkRunCounts[key] > 0);
+  // Successes may accompany one unknown state; counts expose the whole mix.
+  const reason = states.length === 1 ? states[0][1] : 'check-runs-mixed';
   return {
     status: 'unknown',
     ok: false,
     details: {
       cliUsed: 'gh',
-      reason: 'check-runs-not-complete',
+      reason,
+      checkRunCounts,
     },
   };
 }
@@ -1189,6 +1216,7 @@ async function checkGithub(repoRoot, deps = {}) {
  *     cliUsed: 'glab'|'gh',
  *     reason?: string,
  *     error?: string,
+ *     checkRunCounts?: { success: number, failure: number, inProgress: number, queued: number, cancelled: number, skipped: number, neutral: number, waiting: number, other: number },
  *     matchedRef?: string,
  *     candidateCount?: number,
  *     candidateStatuses?: string[],
@@ -1202,7 +1230,12 @@ async function checkGithub(repoRoot, deps = {}) {
  * #857 "several contradicting pipelines" and "only foreign-ref pipelines"
  * findings — and the #1390 "same-sha rows the ref preference set aside"
  * (`droppedCount`/`droppedStatuses`) — are delivered through ADDITIVE `details`
- * fields and `details.reason`,
+ * fields and `details.reason`. GitHub's `checkRunCounts` counts each row once:
+ * `failure` includes action_required; `other` includes malformed/inconsistent
+ * rows and unsupported statuses/conclusions. Non-success reasons are
+ * check-runs-in-progress, check-runs-queued, check-runs-cancelled,
+ * check-runs-skipped, check-runs-neutral, check-runs-waiting (#1526),
+ * check-runs-unrecognised, or check-runs-mixed (multiple non-success kinds),
  * never as a new status value — consumers fail open on an unknown status string
  * and the session-start renderer prints nothing for one.
  */

package/scripts/lib/events-schema.mjs

@@ -239,5 +239,13 @@ export function validateEventRecord(record) {
     );
   }
 
+  if (
+    ['orchestrator.quality_gate.passed', 'orchestrator.quality_gate.failed'].includes(record.event) &&
+    Object.hasOwn(record, 'wave_number') &&
+    (!Number.isSafeInteger(record.wave_number) || record.wave_number <= 0)
+  ) {
+    errors.push('quality_gate wave_number must be a positive safe integer when present');
+  }
+
   return { valid: errors.length === 0, errors };
 }

package/scripts/lib/quality-gate-wave.mjs

@@ -0,0 +1,40 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { classifyManifestSession, readProcessLocalSessionIds } from './session-identity/own-session.mjs';
+import { findOwnScopeFile } from './scope-gate.mjs';
+
+/**
+ * Resolve the active wave number from the wave-scope sidecar (#966 step 1).
+ *
+ * Mirrors `resolveWave()` in `hooks/pre-bash-memory-propose-audit.mjs` — the
+ * same `.{pi,cursor,codex,claude}/wave-scope.json` precedence via
+ * {@link findOwnScopeFile}, skipping a PEER session's manifest in the same
+ * working copy (#1504: a peer-only result is no wave of ours, never the peer's
+ * number) — with ONE deliberate difference: the hook returns `0` for "no
+ * wave-scope file", this returns `null`.
+ *
+ * Absent is not zero. A human running `npm run quality-gate` from a `git push`
+ * has no wave at all, and that is the common case; publishing `wave_number: 0`
+ * would invent a wave 0 that every consumer then has to special-case. The
+ * caller spreads the result so the KEY is omitted, exactly as `counts` is.
+ *
+ * A non-positive, unsafe or non-integer `wave` field is treated the same way — waves
+ * are 1-indexed, so `0` on disk carries no more information than an absent file.
+ *
+ * Never throws.
+ *
+ * @param {string} projectDir — directory whose wave-scope sidecar to read.
+ * @returns {number|null} positive safe integer wave number, or `null` when there is no wave.
+ */
+export function resolveWaveNumber(projectDir) {
+  try {
+    const ownIds = new Set(readProcessLocalSessionIds({ env: process.env, hookInput: null }));
+    const { path: waveFile } = findOwnScopeFile(projectDir, ownIds, classifyManifestSession);
+    if (!waveFile || !existsSync(waveFile)) return null;
+    const wave = JSON.parse(readFileSync(waveFile, 'utf8'))?.wave;
+    if (!Number.isSafeInteger(wave) || wave <= 0) return null;
+    return wave;
+  } catch {
+    return null;
+  }
+}
+

package/scripts/lib/quality-gate.mjs

@@ -67,6 +67,7 @@ import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 import { emitEvent, sessionAttribution } from './events.mjs';
+import { resolveWaveNumber } from './quality-gate-wave.mjs';
 import { parsePorcelainZ } from './git-porcelain.mjs';
 import { admitSuiteCounts, extractTestCounts } from './gates/gate-helpers.mjs';
 import {
@@ -834,32 +835,30 @@ export function gateKillFields(run) {
  * test gate (fail-fast on lint/typecheck) or its output carried no parseable
  * count. See {@link suiteCountsFromOutput}.
  *
- * IT DOES NOT YET REPLACE THE PROSE PATH (#957/F1 — the earlier wording here
- * claimed it did). `waves[].suite_passed` / `suite_failed` still travel as prose
- * through two LLM hops: `skills/wave-executor/wave-loop.md` step 7 hand-writes
- * them, `skills/session-end/metrics-collection.md` § 1.7 parses them back out of
- * the STATE.md Wave History header into sessions.jsonl. `counts` is a SECOND,
- * machine-measured emission of the same fact. Measured 2026-10-05 against this
- * repo's `.orchestrator/metrics/events.jsonl` (main checkout @ 1386a98e; the
- * file has been rotated since the 4404-record 2026-07-31 reading this note
- * used to quote): 82 `orchestrator.quality_gate.*` records, 46 carrying
- * `counts` (`grep '"orchestrator.quality_gate' <file> | grep -c '"counts"'`).
- *
- * `waves[].*` is PER-WAVE, so the event needs a per-wave key. The
- * `scripts/run-quality-gate.mjs` wrapper emits `wave_number` when a wave-scope
- * sidecar names one (#966 step 1, `resolveWaveNumber`) and OMITS it otherwise —
- * 37 of the same 82 records carry it
- * (`grep '"orchestrator.quality_gate' <file> | grep -c '"wave_number"'`).
- * Readers exist: `skills/session-end/metrics-collection.md` § 1.7 reads
- * `counts` by `wave_number` first and keeps the STATE.md header only as a
- * fallback (#966 step 3), and `scripts/lib/convergence-monitor.mjs` folds a
- * gate record only when it carries both. THIS emitter still sets no
- * `wave_number` — its records are mid-wave auto-fix retries, so they fall to
- * that fallback by design. A record without the key could only be attributed
- * to a wave by a wall-clock window whose own boundaries (`waves[].started_at`
- * / `completed_at`) are themselves LLM-written, against the posture
- * `scripts/lib/eval/session-resolve.mjs` documents for window-attributed gate
- * events ("a contaminated window means gate-attribution is unsafe").
+ * Both skill readers now take `counts` from `orchestrator.quality_gate.*`:
+ * `skills/wave-executor/references/wave-loop-review.md` step 7 and
+ * `skills/session-end/metrics-collection.md` § 1.7. They filter the flat record
+ * by the same `semantic_session_id` + `wave_number` and select the last
+ * matching gate run; `counts.passed` / `counts.failed` supply the per-wave
+ * `suite_passed` / `suite_failed`. A third reader,
+ * `scripts/lib/convergence-monitor.mjs`, folds `counts` from gate records
+ * that also carry `wave_number`. This library emits ONE record per
+ * `runQualityGateWithRetry` call, not per retry; `attempts` carries retries.
+ *
+ * Both emitters resolve `wave_number` from the existing own-session manifest
+ * at the event's repoRoot and omit it without a usable source. No wall-clock
+ * attribution or guessed wave number is added. Missing counts are not zeros.
+ * Count fallback is limited to pre-#954 sessions, gates outside the event
+ * wrapper, or missing wave attribution; step 7 falls back to this wave's own
+ * gate output (its header is not written yet), session end to the header. Auto-fix with a known wave
+ * uses the event; missing counts alone do not permit header fallback.
+ *
+ * `suite_platform` comes from this wave's gate run (step 7) or the STATE.md
+ * Wave History header `— suite <passed>/<failed> on <platform>` (session end);
+ * the payload has NO platform field.
+ * Event-derived counts may be mirrored into that existing header as
+ * compatibility output, not a second measurement source. Neither the header
+ * nor sessions.jsonl changes its contract.
  *
  * Note also that THIS emitter only runs under `verification-auto-fix.enabled:
  * true` (default `false`, and `false` in this repo's Session Config). The gate
@@ -891,12 +890,14 @@ export function gateKillFields(run) {
  */
 async function emitGateEvent(repoRoot, ok, attempts, gate, counts, killRun = null) {
   try {
+    const waveNumber = resolveWaveNumber(repoRoot);
     await emitEvent(
       `orchestrator.quality_gate.${ok ? 'passed' : 'failed'}`,
       {
         variant: 'auto-fix-loop',
         exit_code: ok ? 0 : 1,
         attempts,
+        ...(waveNumber !== null ? { wave_number: waveNumber } : {}),
         ...(gate ? { gate } : {}),
         ...(counts ? { counts } : {}),
         ...gateKillFields(killRun),

package/scripts/lib/session-record-repair.mjs

@@ -124,12 +124,11 @@ const INCOMPLETE_FIELD_ORDER = Object.freeze([
 const MS_PRECISION_FIELDS = Object.freeze(['started_at', 'completed_at', 'lease_acquired_at']);
 
 /**
- * ISO-8601 UTC with MORE than three fractional digits (`.994600Z`) — the one
- * rejected shape that has an unambiguous canonical form. Group 1 is the value
- * cut at the millisecond. Offsets, `.3Z` and non-ISO strings do not match and
- * stay for the validator to reject: there is no defensible default for them.
+ * ISO-8601 UTC with MORE than three fractional digits and exactly `Z` or
+ * `+00:00` (#1525). Group 1 is the value cut at the millisecond. Nonzero
+ * offsets, other timezone spellings and shorter fractions stay unrepaired.
  */
-const ISO_UTC_SUB_MS_RE = /^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3})\d+Z$/;
+const ISO_UTC_SUB_MS_RE = /^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3})\d+(?:Z|\+00:00)$/;
 
 // ---------------------------------------------------------------------------
 // Helpers
@@ -155,7 +154,13 @@ function isCount(v) {
 function truncateToMs(value) {
   if (typeof value !== 'string') return null;
   const m = ISO_UTC_SUB_MS_RE.exec(value);
-  return m ? `${m[1]}Z` : null;
+  if (!m) return null;
+  const canonical = `${m[1]}Z`;
+  const ms = Date.parse(canonical);
+  // Date.parse rolls over e.g. April 31, non-leap February 29 and 24:00.
+  // Equality with the original calendar components refuses those repairs.
+  if (!Number.isFinite(ms) || new Date(ms).toISOString() !== canonical) return null;
+  return canonical;
 }
 
 function orderIncompleteFields(fields) {
@@ -391,10 +396,16 @@ export function repairRecord(record) {
     preserveRaw(out, 'completed_at', record.completed_at, rescued);
     const endedMs = typeof out.ended_at === 'string' ? Date.parse(out.ended_at) : NaN;
     const startedMs = Date.parse(out.started_at);
-    if (Number.isFinite(endedMs) && Number.isFinite(startedMs) && endedMs >= startedMs) {
+    const endedTruncated = truncateToMs(out.ended_at);
+    if (typeof out.ended_at === 'string' &&
+        (!Number.isFinite(endedMs) ||
+         (ISO_UTC_SUB_MS_RE.test(out.ended_at) && endedTruncated === null))) {
+      // Preserve an invalid legacy measurement for the final schema gate to
+      // reject; do not turn it into a valid default or a rolled-over date.
+      out.completed_at = out.ended_at;
+    } else if (Number.isFinite(endedMs) && Number.isFinite(startedMs) && endedMs >= startedMs) {
       // The COPY is cut to milliseconds; `ended_at` itself is not a validated
       // field and keeps its original bytes, so nothing needs a sidecar here.
-      const endedTruncated = truncateToMs(out.ended_at);
       if (endedTruncated !== null) precisionCut = true;
       out.completed_at = endedTruncated ?? out.ended_at;
     } else {

package/scripts/lib/session-schema/validator.mjs

@@ -182,6 +182,12 @@ function _validateTimestamps(entry) {
       `started_at must match ISO-8601 UTC ms format (YYYY-MM-DDTHH:MM:SS[.SSS]Z), got: ${entry.started_at}`
     );
   }
+  // Date.parse normalizes impossible calendar dates; compare without mutating the record.
+  const startedCanonical = entry.started_at.includes('.')
+    ? entry.started_at : entry.started_at.replace(/Z$/, '.000Z');
+  if (new Date(startedMs).toISOString() !== startedCanonical) {
+    throw new ValidationError(`started_at must be a valid calendar timestamp, got: ${entry.started_at}`);
+  }
   if (typeof entry.completed_at !== 'string') {
     throw new ValidationError('completed_at must be an ISO timestamp string');
   }
@@ -194,6 +200,12 @@ function _validateTimestamps(entry) {
       `completed_at must match ISO-8601 UTC ms format (YYYY-MM-DDTHH:MM:SS[.SSS]Z), got: ${entry.completed_at}`
     );
   }
+  // Date.parse normalizes impossible calendar dates; compare without mutating the record.
+  const completedCanonical = entry.completed_at.includes('.')
+    ? entry.completed_at : entry.completed_at.replace(/Z$/, '.000Z');
+  if (new Date(completedMs).toISOString() !== completedCanonical) {
+    throw new ValidationError(`completed_at must be a valid calendar timestamp, got: ${entry.completed_at}`);
+  }
   if (completedMs < startedMs) {
     throw new ValidationError(
       `completed_at (${entry.completed_at}) must be >= started_at (${entry.started_at})`

package/scripts/lib/session-start-probes.mjs

@@ -258,10 +258,11 @@ function commitRunsCommand(gh, sha) {
  * @returns {string}
  */
 function ciUnknownHint(result) {
-  if (!PUSHED_FOLLOW_UP_REASONS.has(result?.details?.reason)) return CI_UNKNOWN_HINT_DEFAULT;
-  // The GitHub reason names the gh CLI; a glab command there would be wrong.
-  const gh = result.details.cliUsed === 'gh';
+  // Every GitHub unknown reason needs a GitHub hint, including running,
+  // queued and cancelled checks that do not trigger a pushed-commit query.
+  const gh = result?.details?.cliUsed === 'gh';
   const onDemand = gh ? 'run `gh run list` on demand' : CI_UNKNOWN_HINT_DEFAULT;
+  if (!PUSHED_FOLLOW_UP_REASONS.has(result?.details?.reason)) return onDemand;
   const pushed = result.pushed && typeof result.pushed === 'object' ? result.pushed : null;
   // Pure (#1396): the SHA is whatever the follow-up resolved inside the budget.
   // Without `pushed` (the follow-up overran or threw before resolving it) the
@@ -275,6 +276,20 @@ function ciUnknownHint(result) {
   return `last pushed: ${short} (pipeline not checked; run \`${commitRunsCommand(gh, sha)}\`)`;
 }
 
+/** Additive GitHub diagnostics; absent counts leave existing banners unchanged. */
+function checkRunCountsText(result) {
+  const counts = result?.details?.checkRunCounts;
+  if (!counts || result?.details?.cliUsed !== 'gh') return '';
+  const parts = [
+    ['success', 'successful'], ['failure', 'failed/action required'],
+    ['inProgress', 'in progress'], ['queued', 'queued'],
+    ['cancelled', 'cancelled'], ['skipped', 'skipped'],
+    ['neutral', 'neutral'], ['waiting', 'waiting'], ['other', 'unrecognised'],
+  ].filter(([key]) => Number.isSafeInteger(counts[key]) && counts[key] > 0)
+    .map(([key, label]) => `${label}: ${counts[key]}`);
+  return parts.length ? ` — Check runs: ${parts.join(', ')}` : '';
+}
+
 /**
  * "Green, but allow_failure jobs failed" — the ONE predicate both the
  * `ci-status` renderer and its `severityOf` use (#1333). Two predicates once
@@ -584,7 +599,7 @@ export const PROBES = [
         // #1337: a RED pushed commit is an alert, and the banner says what the
         // rule judges (HR-106) — same 🚨 as a red HEAD.
         const mark = r.pushed?.verdict?.status === 'red' ? '🚨' : '⚠';
-        return `${mark} ci-status: CI status for HEAD could not be determined (${reason}) — ${ciUnknownHint(r)}`;
+        return `${mark} ci-status: CI status for HEAD could not be determined (${reason})${checkRunCountsText(r)} — ${ciUnknownHint(r)}`;
       }
       if (r.status === 'red') {
         const pid = r.details?.currentPipelineId ?? '?';
@@ -592,7 +607,7 @@ export const PROBES = [
           ? ` — last green: #${r.lastGreen.pipelineId} (commit ${String(r.lastGreen.sha ?? '').slice(0, 7)}, ${r.redCount} pipelines ago)`
           : '';
         const job = r.failingJobName ? ` Failing job: ${r.failingJobName}` : '';
-        return `🚨 CI RED on HEAD (pipeline #${pid})${green}.${job}`;
+        return `🚨 CI RED on HEAD (pipeline #${pid})${green}.${job}${checkRunCountsText(r)}`;
       }
       if (r.status === 'green') {
         const lines = [];

package/scripts/lib/wave-executor/remote-dispatch.mjs

@@ -412,6 +412,11 @@ export async function dispatchRemote(
  * `Ferdinands-Macbook-2 ready=yes · load 14.23 · mem free 96% · headless: slots
  * none, keychain-route ok · 9 jobs · claude procs 12`
  *
+ * New doctor lines split `gate-ready` and `headless-ready`; only the latter
+ * authorizes Claude dispatch. Legacy `ready` remains accepted without new markers.
+ * `load` also holds the new `load5 (5 min)` reading; `memFreePct` holds free
+ * (Darwin) or available (Linux) percent. No live new-format measurement is implied.
+ *
  * Every metric is `null` when its segment is absent — never a fabricated `0`,
  * which would read as "measured, idle" for a host that answered nothing.
  * @param {string} raw
@@ -420,19 +425,32 @@ export async function dispatchRemote(
  */
 export function parseDoctorLine(raw) {
   const text = String(raw ?? '');
-  const num = (re) => {
+  // New-format markers suppress the legacy fallback, even if their value or
+  // key boundary is malformed. Conflicting/unknown headless values fail closed.
+  const key = /\b(?:gate-ready|headless-ready)\b/i.test(text) ? 'headless-ready' : 'ready';
+  const values = [...text.matchAll(new RegExp(`(?:^|\\s)${key}=([^\\s]*)`, 'gi'))];
+  const count = (re) => {
     const m = re.exec(text);
     return m ? Number(m[1]) : null;
   };
+  const segments = text.split(/[·\r\n]/).map((segment) => segment.trim());
+  const num = (re, max = Infinity) => {
+    const m = segments.map((segment) => re.exec(segment)).find(Boolean);
+    const value = m ? Number(m[1]) : NaN;
+    return Number.isFinite(value) && value <= max ? value : null;
+  };
   return {
-    // `ready` is the ONLY decision field: anything that is not a literal
-    // `ready=yes` is not-ready, including an unparseable line.
-    ready: /\bready=yes\b/i.test(text),
+    // Claude dispatch uses headless readiness, independently of gate readiness.
+    // Only the old format falls back to an exact, standalone `ready=yes` token.
+    ready: values.length > 0 && values.every((m) => /^yes$/i.test(m[1])),
     raw: text,
-    load: num(/\bload\s+([0-9]+(?:\.[0-9]+)?)/i),
-    memFreePct: num(/\bmem free\s+([0-9]+(?:\.[0-9]+)?)\s*%/i),
-    jobs: num(/\b([0-9]+)\s+jobs?\b/i),
-    claudeProcs: num(/\bclaude procs\s+([0-9]+)/i),
+    load: num(/^load(?:5\s+\(5 min\))?\s+([0-9]+(?:\.[0-9]+)?)$/i),
+    // The existing field holds Darwin free % or Linux available %, never kB.
+    memFreePct:
+      num(/^mem (?:free|available)\s+([0-9]+(?:\.[0-9]+)?)\s*%$/i, 100) ??
+      num(/^mem available\s+[0-9]+\s+kB available\s*\/\s*[0-9]+\s+kB total\s+\(([0-9]+(?:\.[0-9]+)?)% available\)$/i, 100),
+    jobs: count(/\b([0-9]+)\s+jobs?\b/i),
+    claudeProcs: count(/\bclaude procs\s+([0-9]+)/i),
   };
 }
 
@@ -491,7 +509,7 @@ export function remoteDoctor({ host, execFn = execFileSync, timeoutMs = 90_000 }
  * @param {string} alias — declared host alias (`remote-hosts[].alias`).
  * @param {object} [opts]
  * @param {Function} [opts.execFn] — `child_process.execFileSync` seam.
- * @returns {Promise<boolean>} true only on a literal `ready=yes` line.
+ * @returns {Promise<boolean>} true only for headless-ready=yes (legacy ready=yes without new markers).
  */
 export async function remoteReadyProbe(alias, { execFn } = {}) {
   try {

package/scripts/lib/wave-resource-gate.mjs

@@ -134,7 +134,8 @@ async function applyDecisionRules(measurements, opts) {
  * The gate does NOT probe the network — a placement decision must stay a pure
  * function of its inputs. The caller supplies a readiness WITNESS:
  *   - `opts.remoteReady` — `{ [alias]: boolean }`, e.g. built from the
- *     SessionStart `Offload m5: ready=yes` banner or `remoteDoctor()`.
+ *     SessionStart `Offload <alias>: headless-ready=yes` banner (legacy `ready=yes` only
+ *     without new readiness markers) or `remoteDoctor().ready`.
  *   - `opts.probeFn` — `async (alias) => boolean`, consulted only for hosts the
  *     `remoteReady` map does not already answer for. Default `null`. A probeFn
  *     that REJECTS is read as not-ready and its message is appended to

package/scripts/release.mjs

@@ -387,11 +387,14 @@ const INTENTIONAL_TEST_ASSET_PATHS = new Set([
 // `scripts/lib/locks/index.mjs` is the one-cycle deprecation shim (5.2.0 CHANGELOG, Changed): its
 // runtime warning names the version it was deprecated IN, so it legitimately carries the previous
 // release literal until its 6.0.0 removal — version history by construction, not drift.
+// `skills/eval/rubric-v3.md` (5.9.0 sweep, measured 2026-10-06): its change log quotes the dated
+// owner decision "rubric-v3 in 5.8.0" (2026-10-05, #1487) — the release that introduced the rubric.
+// Prose history, not a version surface; bumping it would falsify the quote.
 // `site/_census.json` is deliberately NOT allowlisted: it carries a `"version"` field that
 // `--set-version` re-stamps (scripts/site-numbers.mjs --write, see the post-bump hint in main()),
 // so leaving it under the drift sweep makes the sweep double as its staleness gate — a census
 // not re-stamped after a bump fails `--check` instead of shipping the previous version.
-export const HISTORY_ALLOWLIST = /^(CHANGELOG\.md|README\.md|scripts\/lib\/locks\/index\.mjs|CLAUDE\.md|AGENTS\.md|CONTRIBUTING\.md|NOTICE|\.husky\/pre-push|docs\/|tests\/|skills\/npm-publish\/|skills\/architecture\/references\/domain-model\.md|skills\/autopilot\/SKILL\.md|scripts\/release\.mjs|\.orchestrator\/|site\/leaderboard\.json|site\/guide\/index\.html|site\/llms-full\.txt|skills\/release\/SKILL\.md|marketing\/remotion\/(?:README\.md|campaign\.json|render-receipt\.json|src\/ReleaseFilm\.tsx)$)/;
+export const HISTORY_ALLOWLIST = /^(CHANGELOG\.md|README\.md|scripts\/lib\/locks\/index\.mjs|CLAUDE\.md|AGENTS\.md|CONTRIBUTING\.md|NOTICE|\.husky\/pre-push|docs\/|tests\/|skills\/npm-publish\/|skills\/architecture\/references\/domain-model\.md|skills\/autopilot\/SKILL\.md|skills\/eval\/rubric-v3\.md|scripts\/release\.mjs|\.orchestrator\/|site\/leaderboard\.json|site\/guide\/index\.html|site\/llms-full\.txt|skills\/release\/SKILL\.md|marketing\/remotion\/(?:README\.md|campaign\.json|render-receipt\.json|src\/ReleaseFilm\.tsx)$)/;
 
 /** Pure check over packed-entry lines. Returns violations: {name, line}[]. */
 export function checkLeakage(lines) {

package/scripts/run-quality-gate.mjs

@@ -55,8 +55,8 @@ import {
   resolveGateTimeoutMs,
 } from './lib/gates/gate-helpers.mjs';
 import { buildCommandSignature, spawnInGroup } from './lib/process-group.mjs';
-import { classifyManifestSession, readProcessLocalSessionIds } from './lib/session-identity/own-session.mjs';
-import { findOwnScopeFile } from './lib/scope-gate.mjs';
+import { resolveWaveNumber } from './lib/quality-gate-wave.mjs';
+import { readProcessLocalSessionIds } from './lib/session-identity/own-session.mjs';
 import { gateKillFields } from './lib/quality-gate.mjs';
 import { isMainModule } from './lib/is-main-module.mjs';
 import { shellQuote } from './lib/sh-quote.mjs';
@@ -266,42 +266,6 @@ function resolveLedgerRoot(value) {
   return null;
 }
 
-/**
- * Resolve the active wave number from the wave-scope sidecar (#966 step 1).
- *
- * Mirrors `resolveWave()` in `hooks/pre-bash-memory-propose-audit.mjs` — the
- * same `.{pi,cursor,codex,claude}/wave-scope.json` precedence via
- * {@link findOwnScopeFile}, skipping a PEER session's manifest in the same
- * working copy (#1504: a peer-only result is no wave of ours, never the peer's
- * number) — with ONE deliberate difference: the hook returns `0` for "no
- * wave-scope file", this returns `null`.
- *
- * Absent is not zero. A human running `npm run quality-gate` from a `git push`
- * has no wave at all, and that is the common case; publishing `wave_number: 0`
- * would invent a wave 0 that every consumer then has to special-case. The
- * caller spreads the result so the KEY is omitted, exactly as `counts` is.
- *
- * A non-positive or non-numeric `wave` field is treated the same way — waves
- * are 1-indexed, so `0` on disk carries no more information than an absent file.
- *
- * Never throws.
- *
- * @param {string} projectDir — directory whose wave-scope sidecar to read.
- * @returns {number|null} positive wave number, or `null` when there is no wave.
- */
-function resolveWaveNumber(projectDir) {
-  try {
-    const ownIds = new Set(readProcessLocalSessionIds({ env: process.env, hookInput: null }));
-    const { path: waveFile } = findOwnScopeFile(projectDir, ownIds, classifyManifestSession);
-    if (!waveFile || !existsSync(waveFile)) return null;
-    const wave = JSON.parse(readFileSync(waveFile, 'utf8'))?.wave;
-    if (typeof wave !== 'number' || !Number.isFinite(wave) || wave <= 0) return null;
-    return Math.trunc(wave);
-  } catch {
-    return null;
-  }
-}
-
 // ---------------------------------------------------------------------------
 // Main — the CLI body. Guarded below so a bare `import()` runs none of it.
 // ---------------------------------------------------------------------------
@@ -471,7 +435,13 @@ async function main() {
   //
   // stdout is PIPED (not inherited) so the suite counts the gate already computed
   // can be lifted straight off its JSON envelope into telemetry (#954) instead of
-  // travelling as prose through the STATE.md header. The envelope is re-emitted
+  // travelling as prose through the STATE.md header. Both skill readers select
+  // the last matching flat event by semantic_session_id + wave_number; there is
+  // no platform field on the payload. Count fallback (wave-loop step 7: this
+  // wave's own gate output; session end: the STATE.md header) is limited to
+  // pre-#954 sessions, gates outside the event wrapper, or missing wave
+  // attribution (see docs/events-schema.md).
+  // The envelope is re-emitted
   // verbatim below, so the stdout contract is unchanged — a gate sub-script writes
   // exactly one JSON line at the very end (its own child commands are captured by
   // `runCheck`), so nothing streamed before and nothing streams now.

package/scripts/site-numbers.mjs

@@ -996,11 +996,15 @@ export const SITEMAP_FILE = 'sitemap.xml';
  * Unknown either way is an ERROR, never a skip (the `METRIC_IDS` rule): a
  * sitemap `<loc>` missing here would never be dated, and a page carrying cells
  * that is missing here would drift unseen.
+ *
+ * A page without counted cells (for example /lead) never has its <lastmod>
+ * raised automatically: bump it by hand whenever its content changes.
  */
 export const SITEMAP_PAGES = Object.freeze([
   { page: 'index.html', loc: 'https://session-orchestrator.com/' },
   { page: 'de/index.html', loc: 'https://session-orchestrator.com/de' },
   { page: 'guide/index.html', loc: 'https://session-orchestrator.com/guide' },
+  { page: 'lead/index.html', loc: 'https://session-orchestrator.com/lead' },
   { page: 'impressum/index.html', loc: 'https://session-orchestrator.com/impressum' },
   { page: 'datenschutz/index.html', loc: 'https://session-orchestrator.com/datenschutz' },
 ]);

package/skills/_shared/fleet-protocol.md

@@ -8,6 +8,8 @@ knows paths, fields, deadlines and lease validity; `scripts/fleet-checkin.mjs` w
 This file describes them and never redefines them. The coordinator itself is not part of this
 package: it is operated outside the plugin, which owns its operational detail (how it measures,
 which conditions it issues, how it acquires and hands over the lease).
+A public coordinator that implements this contract is lead-session-orchestrator
+(https://session-orchestrator.com/lead); any other tool that writes the same files works too.
 
 **Grundsatz (CSM-003).** Zustand liegt in Dateien; Nachrichten sind nur Hinweise auf eine Datei.
 Der Navigator erteilt keine Freigaben — maßgeblich ist der Owner-Auftrag der Session. Eine Datei,

package/skills/remote-offload/SKILL.md

@@ -30,7 +30,7 @@ Exit codes (`offload --help`, measured 2026-09-02): `0` ok · `1` usage/config
 
 The gate decides, not the coordinator. `applyOffloadDecision()` in `scripts/lib/wave-resource-gate.mjs` fires when the resource verdict is `reduce` or `coordinator-direct` (and, with `offload-first: true`, on `proceed` as well — see below), and only AFTER the HR-004 heavy-repo cap — a capped wave that offloads still respects the cap. It never probes the network; the coordinator supplies a readiness WITNESS:
 
-- `opts.remoteReady` — `{ [alias]: boolean }`, built from the SessionStart banner line `Offload <alias>: ready=yes …`, or
+- `opts.remoteReady` — `{ [alias]: boolean }`, built from the SessionStart banner line `Offload <alias>: headless-ready=yes …` (legacy `ready=yes` only without new readiness markers; `gate-ready` does not authorize Claude dispatch), or
 - `opts.probeFn` — an async `(alias) => boolean` fallback, consulted only for aliases `remoteReady` doesn't answer for (backed by `remoteDoctor()`, i.e. `offload doctor -H <alias> --brief` parsed by `parseDoctorLine()`).
 
 With neither supplied, no host counts as ready and the wave stays local — the gate fails toward local, never toward an unverified host. A role in `NEVER_FOREIGN_ROLES` (`scripts/lib/wave-executor/dispatch-common.mjs`: `impl-core`, `security-review`, `migration`, `release`, `secrets`, `incident`, `refactor-crosscut`) is never offloaded regardless of readiness.

package/skills/session-end/metrics-collection.md

@@ -172,19 +172,25 @@ Finalize session metrics by reading the wave data accumulated during execution:
 > - `effectiveness`: ALWAYS populated from Phase 1 plan verification results, and CONSTRUCTED EXPLICITLY in the METRICS_ENTRY snippet (#773) — never deferred to a "remember to add" optional step (that omission is how `carryover: 0` slipped past 41 records). `completion_rate` = `completed / planned_issues` (0.0-1.0, where 0.0 means nothing was completed). **`carryover` counting rule (#773):** `carryover` is the **length of the Phase 1.65 gate carry-list** — `autoCarry` ∪ the middle-band `ask` items the operator LEFT SELECTED ∪ the answered-question `impliesWork: true` candidates — NOT the raw Phase 1.2+1.3 candidate count. On the fail-open skip (gate disabled / headless / AUQ unavailable), EVERY candidate carries, so `carryover` = the full candidate-list length. Count the gate's OUTPUT (what reaches Phase 5 Step 3 filing), not its INPUT.
 > - `effectiveness.override_ratio` (#730/H5): OPTIONAL nested field = `overridden_findings / max(total_findings_surfaced, 1)` (float 0.0-1.0). Populate ONLY when Phase 2.6 (Broken-Window Budget) ran this session (`broken-window-budget.enabled: true`). OMIT (do NOT write null/0) otherwise — **absent = "not measured"**, `0.0` = "measured, nothing overridden". `overridden_findings` = the summed `count` of the `orchestrator.finding.overridden` events emitted this session; `total_findings_surfaced` = every MED/LOW+ finding surfaced across Phase 1.8 + wave reviewers.
 > - `waves[].agent_count_planned` / `waves[].agent_count_started` / `waves[].agent_count_completed` (#724/#1115): OPTIONAL per-wave fields, sourced from `wave-loop.md` § Capture wave metrics step 7 — mirror its definitions exactly, do not re-derive them here. `agent_count_planned` = agents named in the session plan for this wave. `agent_count_started` = distinct agents whose `agent-<id>.meta.json` sidecar is present, after any silent-drop re-dispatch — NOT "produced a tool-result" (under background dispatch the launch ack is a result and would count an agent that never ran). `agent_count_completed` = distinct agents whose task-notification (`<status>completed</status>`) arrived. Omit each field when the wave did not measure it — **absent = "not measured"**, never zero-fill; `0` would read as "measured, no agent started", which is the opposite of an unmeasured wave. The two gaps carry the diagnosis: `agent_count_planned > agent_count_started` after re-dispatch is a persistent silent drop, `agent_count_started > agent_count_completed` at wave end is an agent that started and never returned. Both are also logged to STATE.md `## Deviations` by wave-loop.md, so a record and a deviation entry should agree.
-> - `waves[].suite_passed` / `waves[].suite_failed` / `waves[].suite_platform` (#944): OPTIONAL per-wave fields. Omit all three when absent — absent = "not measured", `suite_failed: 0` = "measured, zero failures".
->   **`suite_passed` / `suite_failed`: read the event FIRST, the STATE.md header only as fallback (#966 step 3).** Since #954/#967 the between-waves gate wrapper `scripts/run-quality-gate.mjs` emits `orchestrator.quality_gate.{passed,failed}` with a machine-measured `counts: {passed, failed, total}` AND the `wave_number` it resolved from the `wave-scope.json` sidecar, so per-wave attribution needs no wall-clock window join. Payload fields are flat at the record's top level; for each wave `N` of this session:
+> - `waves[].suite_passed` / `waves[].suite_failed` / `waves[].suite_platform` (#944): OPTIONAL per-wave fields. Treat counts and header platform independently; absent = "not measured", `suite_failed: 0` = "measured, zero failures".
+>   **`suite_passed` / `suite_failed`: read the event FIRST, the STATE.md header only as fallback (#966 step 3).** Since #954/#967 the between-waves gate wrapper `scripts/run-quality-gate.mjs` emits `orchestrator.quality_gate.{passed,failed}` with a machine-measured `counts: {passed, failed, total}` AND the `wave_number` it resolved from the `wave-scope.json` sidecar, so per-wave attribution needs no wall-clock window join. Payload fields are flat at the record's top level; for each wave of this session:
 >
 >   ```bash
->   jq -c --argjson w N --arg s "<semantic_session_id>" '
->     select(.event | startswith("orchestrator.quality_gate."))
->     | select(.semantic_session_id == $s and .wave_number == $w and .counts != null)
->     | .counts' .orchestrator/metrics/events.jsonl | tail -1
+>   jq -cR --argjson w "$WAVE" --arg s "$SEMANTIC_SESSION_ID" '
+>     fromjson? | objects
+>     | select((.event | type) == "string" and (.event | startswith("orchestrator.quality_gate.")))
+>     | select(.semantic_session_id == $s and .wave_number == $w and .["counts"] != null)
+>     | .["counts"]
+>   ' .orchestrator/metrics/events.jsonl | tail -1
 >   ```
 >
->   Filtering by `semantic_session_id` is mandatory — `events.jsonl` accumulates across sessions and every past session also had a wave `N`. Take the LAST matching record (the wave's final gate run); `counts.passed` → `suite_passed`, `counts.failed` → `suite_failed`. No match = the field was not measured for that wave → omit, never zero-fill (the producer already omits `counts` rather than zero-filling when a run fail-fast'd before the test gate).
->   **Fallback, still live:** when no event matches, fall back to the STATE.md Wave History header `— suite <passed>/<failed> on <platform>` (written by wave-executor §3a since #944). Three cases genuinely need it: pre-#954 sessions, a gate run outside the `run-quality-gate.mjs` wrapper, and the `verification-auto-fix` producer in `scripts/lib/quality-gate.mjs`, which emits `counts` but no `wave_number` (its records are mid-wave retries, so not matching the selector is correct).
->   **`suite_platform` has no event source at all** and is read from the STATE.md header, unchanged. **Remaining work to retire the prose path fully:** (1) carry the platform on the gate event payload; (2) once a session has landed with the event path green and no fallback hits, drop the hand-written trio from `wave-loop.md` step 7. Until both hold, the trio stays written — deleting the writer before the reader is proven loses the numbers for sessions in flight.
+>   `WAVE` and `SEMANTIC_SESSION_ID` come from the existing own session/wave identity; never construct either for this lookup. Filtering by both is mandatory: the ledger accumulates across sessions, and a different session or wave must not supply these counts. `counts.passed` → `suite_passed`, `counts.failed` → `suite_failed`. `tail -1` selects the last matching gate run of the wave, including auto-fix. `-R` with `fromjson? | objects` skips an unreadable ledger line (a torn tail from a killed writer, #1401) instead of letting one parse error end `jq` and silently empty the selector behind `| tail -1`. The library emits one record per `runQualityGateWithRetry` call, not per retry; `attempts` is not a record count.
+>
+>   **Header fallback for counts is limited to three cases:** pre-#954 sessions, a gate run outside the event wrapper, or missing wave attribution (including an auto-fix call without a readable own wave scope). An event without `semantic_session_id` cannot match the selector — emitters set it only from the session lock via `sessionAttribution()` — and is treated like a gate run outside the wrapper. In those cases only, read the STATE.md Wave History header `— suite <passed>/<failed> on <platform>`. An auto-fix call with a known wave uses the event selector above. An empty selector alone is not a fallback case: an event without `counts`, for example after fail-fast before the test suite, supplies no replacement zeros and does not by itself permit header fallback.
+>
+>   If no counts are available and none of those fallback cases applies, omit `suite_passed` and `suite_failed`. Absent means "not measured"; a present `suite_failed: 0` means "measured, zero failures". Never zero-fill missing measurements.
+>
+>   **`suite_platform` comes separately and exclusively from the STATE.md Wave History header. There is no platform field in the event payload.** Omit it when no header platform measurement is available; do not infer it from `variant`, runner OS, or session platform. Event-derived counts may still be mirrored into the existing header as compatibility output, not a second measurement source; keep the header and sessions.jsonl contracts unchanged.
 > - `open_questions_asked` / `open_questions_answered` / `open_questions_deferred` (#773): the three open-question counts from the Phase 1.65 gate's AUQ Call 2 (identical to the `questions_*` payload fields on the `orchestrator.handover.gated` event). Top-level, additive, non-negative integers. Populate ONLY when the gate ran an interactive triage ("Closen + Triage" path). OMIT all three (do NOT write `0`) when the gate was skipped (fail-open / headless / disabled) or took the fast-path — absent = "not measured", `0` = "measured, zero questions". Validator accepts absent/null/non-negative-integer.
 > - `stagnation_events`: populated ONLY when ≥1 stagnation event was logged to `events.jsonl` during this session. When `total == 0`, the field is omitted from the JSONL entry.
 > - `grounding_injections`: populated ONLY when ≥1 `orchestrator.grounding.injected` event was logged to `events.jsonl` during this session. When `count == 0`, the field is omitted from the JSONL entry.

package/skills/wave-executor/references/wave-loop-dispatch.md

@@ -84,7 +84,7 @@ const gate = await evaluateWaveResourceGate({
 
 **The offload witness is supplied, never probed (#1160).** The gate's own JSDoc states it: `@param {Record<string, boolean>} [opts.remoteReady] — #1160 readiness witness per declared host alias. The gate never probes the network itself; without a witness no host counts as ready and the decision stays local.` So an `offload` decision is impossible unless the coordinator passes one of two things alongside `config`/`plannedAgents`/`waveRole`:
 
-- `remoteReady: { '<alias>': true }` — built from the SessionStart banner line `Offload <alias>: ready=yes`, which was measured at session start and needs no new network call here; or
+- `remoteReady: { '<alias>': true }` — built from the SessionStart banner line `Offload <alias>: headless-ready=yes` (legacy `ready=yes` only without new readiness markers; `gate-ready` does not authorize Claude dispatch), which was measured at session start and needs no new network call here; or
 - `probeFn: remoteReadyProbe` from `scripts/lib/wave-executor/remote-dispatch.mjs` — `@param {(alias: string) => Promise<boolean>} [opts.probeFn] — optional async witness, consulted only for aliases absent from `remoteReady`. Default null.` Use it when the banner is stale or absent; it costs a live probe per alias.
 
 Passing neither is a valid choice, not a bug: the gate then behaves exactly as it did before #1160 and reduces locally.

package/skills/wave-executor/references/wave-loop-review.md

@@ -378,15 +378,21 @@ If the commit itself fails (e.g., nothing to commit, pre-commit hook rejects), d
      **Copy the two counts off the gate's own event — do not re-read them from the terminal (#966 step 3).** `scripts/run-quality-gate.mjs`, the wrapper that fires between waves, emits `orchestrator.quality_gate.{passed,failed}` carrying a machine-measured `counts: {passed, failed, total}` (admitted by `admitSuiteCounts()`) plus the `wave_number` it resolved from `wave-scope.json`. Payload fields are flat at the record's top level:
 
      ```bash
-     jq -c --argjson w <wave_number> --arg s "<semantic_session_id>" '
-       select(.event | startswith("orchestrator.quality_gate."))
-       | select(.semantic_session_id == $s and .wave_number == $w and .counts != null)
-       | .counts' .orchestrator/metrics/events.jsonl | tail -1
+     jq -cR --argjson w "$WAVE" --arg s "$SEMANTIC_SESSION_ID" '
+       fromjson? | objects
+       | select((.event | type) == "string" and (.event | startswith("orchestrator.quality_gate.")))
+       | select(.semantic_session_id == $s and .wave_number == $w and .["counts"] != null)
+       | .["counts"]
+     ' .orchestrator/metrics/events.jsonl | tail -1
      ```
 
-     The session filter is not optional — `events.jsonl` accumulates across sessions and every past session also had a wave with this number.
-     **OMIT all three when that selector returns nothing** — absent = "not measured", `suite_failed: 0` = "measured, zero failures". Never write `0` for a suite that did not run. The event enforces the same distinction at the producer: `counts` is omitted, never zero-filled, when the run fail-fast'd before the test gate or its output carried no parseable count.
-     > **What is NOT on the event, and stays hand-written:** `suite_platform` — the payload has no platform field, so keep writing it from the § 3a header as before. Likewise, the auto-fix-loop producer (`scripts/lib/quality-gate.mjs`, active only under `verification-auto-fix.enabled: true`) emits `counts` WITHOUT `wave_number`, so its retry records correctly never match the selector above; they are mid-wave attempts, not the wave's verdict. If the wave's gate ran outside `run-quality-gate.mjs` entirely, no event exists — fall back to the gate output you read, and say so in the progress update. The reader side (`skills/session-end/metrics-collection.md` § 1.7) reads the event first and this hand-written trio second, so keep writing the trio: it is the compatibility path for those two cases and for sessions already in flight.
+     `WAVE` and `SEMANTIC_SESSION_ID` come from the existing own session/wave identity; never construct either for this lookup. Filtering by both is mandatory: the ledger accumulates across sessions, and a different session or wave must not supply these counts. `counts.passed` → `suite_passed`, `counts.failed` → `suite_failed`. `tail -1` selects the last matching gate run of the wave, including auto-fix. `-R` with `fromjson? | objects` skips an unreadable ledger line (a torn tail from a killed writer, #1401) instead of letting one parse error end `jq` and silently empty the selector behind `| tail -1`. The library emits one record per `runQualityGateWithRetry` call, not per retry; `attempts` is not a record count.
+
+     **Fallback for counts is limited to three cases:** pre-#954 sessions, a gate run outside the event wrapper, or missing wave attribution (including an auto-fix call without a readable own wave scope). An event without `semantic_session_id` cannot match the selector — emitters set it only from the session lock via `sessionAttribution()` — and is treated like a gate run outside the wrapper. In those cases only, fall back to the gate output you read for this wave — the same run whose counts go into the § 3a header — and say so in the progress update. Do not read the STATE.md Wave History header here: this step runs before § 3a writes this wave's header, so the newest header line there belongs to the previous wave. An auto-fix call with a known wave uses the event selector above. An empty selector alone is not a fallback case: an event without `counts`, for example after fail-fast before the test suite, supplies no replacement zeros and does not by itself permit header fallback.
+
+     If no counts are available and none of those fallback cases applies, omit `suite_passed` and `suite_failed`. Absent means "not measured"; a present `suite_failed: 0` means "measured, zero failures". Never zero-fill missing measurements.
+
+     **`suite_platform` comes separately from that same gate run of this wave — the platform it ran on, which § 3a then writes as `on <platform>` into the header. There is no platform field in the event payload.** Omit it when the platform of that run is not known; never infer it from `variant`. Event-derived counts may still be mirrored into the existing header as compatibility output, not a second measurement source; keep the header and sessions.jsonl contracts unchanged.
    Append this wave record to the session metrics `waves` array.
 
 7a. **Scope drift tripwire (S2 — #896, warn-only)**: session-cumulative and filtered through `DRIFT_EXCLUDE_PATTERNS`, so its `filesRatio` is NOT expected to agree with this wave's unfiltered `files_changed` from step 7. Only the committed part of its numerator starts at `session-start-ref`; the uncommitted and untracked parts read the checkout as it is now, so files already dirty at session start and a same-checkout peer's files count too (an over-report, named as a ceiling in `computeDrift()`'s JSDoc). Call `computeDrift()` from the same `scripts/lib/scope-baseline.mjs` module as `wave-loop-dispatch.md` § 0a Scope Baseline Freeze. Never blocks — exit code stays 0 and the next wave is dispatched regardless of the result.